Re: Finding and Disabling Inactive AD User Accounts

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

Yeah this handled much nicer and tremendously safer from oldcmp... lastLogonTimeStamp and all.

--
Joe Richards Microsoft MVP Windows Server Directory Services
Author of O'Reilly Active Directory Third Edition
www.joeware.net


---O'Reilly Active Directory Third Edition now available---

http://www.joeware.net/win/ad3e.htm


Mallika wrote:
Hi,

You can user DSQUERY command from command line to get all inactive user accounts. Format is

dsquery user OU=Employees,dc=contoso,dc=com -inactive 4

This command will query all users who didn't login to domain for the last 4 weeks.

dsmod user cn=username,OU=Employees,dc=contoso,dc=com -disabled yes.

This command will disable given user ID.

You can pipe this to commands and achive your task.

dsquery user OU=Employees,dc=contoso,dc=com -inactive 4 | dsmod user -disabled yes.

Let me know you need any further help.

Thanks,
Mallika.


"Gibraltar" wrote:

Hello jtux,

There is an attribute called the lastlogontimestamp for each and every user. You can check for that attribute for all theusers through a script and get the users who have not logged in for last 30 days.
For more information on that, check out microsoft website with the keyword lastlogontimestamp.
Cheers,
Gib

"jtux" wrote:

howdy list,

Anybody has experience or script to " find and disable Inactive AD User Accounts for at least 30 or some period of days?

help and suggestion will be appreciated.

jtux,

.

Relevant Pages

  • Re: adfind command
    ... Joe Richards Microsoft MVP Windows Server Directory Services ... > Should I run this command on the domain controller? ...
    (microsoft.public.win2000.active_directory)
  • Re: add sequential users in Active directory
    ... I am currently adding modifications to a command line tool called admod which would do this with a single simply command, but that won't be out for a month or so. ... Joe Richards Microsoft MVP Windows Server Directory Services ... alihn wrote: ...
    (microsoft.public.win2000.active_directory)
  • Re: lastLogonTimestamp
    ... OldCmp reported that the Domain Mode is Windows Server 2003 Domain Mode ... lastLogonTimeStamp download oldcmp and use the -llts option. ... Joe Richards Microsoft MVP Windows Server Directory Services ...
    (microsoft.public.windows.server.active_directory)
  • Re: ghost user in Win2K3 AD group only visible from net group comm
    ... Correct, there is not two different stores, SAM calls get translated to AD Lookups and everything is maintained in the AD DIT. ... The primary group is not stored in the member attribute of groups, it is actually stored as an attribute on the user - primaryGroupID. ... Joe Richards Microsoft MVP Windows Server Directory Services ... We tried to run a "net group /delete" command but it said the user wasn't in the group. ...
    (microsoft.public.windows.server.active_directory)
  • Re: VB Script - Last Logon
    ... I want to send the result from the script to a txt or csv ... shortend the time it takes to replicate this data to all DC's down to ... The whole point of retrieving the lastLogonTimeStamp attribute is so you ... This command creates the ...
    (microsoft.public.vb.general.discussion)